Extracted

• • Target
    a74d1eb912effca167fcd079c6ac567fd75c4697c7e8db3c476e6005edfb91f8
  • Size 45KB
  • SHA256 a74d1eb912effca167fcd079c6ac567fd75c4697c7e8db3c476e6005edfb91f8
  • MD5 0cfb852070b5e1ec61b9c47ce7f7d727
  • SHA1 f8a5de204679c9dc01d9b82b4d6b988b727ca17b
  • SHA512 c9089ddbf913598d7e625a5cf86d1b974574b0512d862843bd4fa7eac46b1ec4d29e0098f3f0502874260752512d6aa532136edda8375494e93feb3128fe9f89
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbSjbXgX3irkKVo3yk7XiCBDZ0x:5uSy6pTpoo2onhb+bwXSp8S8d0x
  • TLSH
    T1C1232B003BE9C12BF2BF5F789DF26145867AF6633A03D54D1CC4129B5613BC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2